How Often Should You Re-Check an AI Vendor?

"How often should we re-check our AI vendors?" Annually, at minimum. But the calendar is only half the answer. The other half is triggers — events that should prompt a fresh look regardless of schedule.

Re-check when the vendor has a security incident, even a small one. How they handled it tells you more than any audit report.

Re-check when they ship a major model update or new feature that touches your data. New capabilities mean new risks, and your original diligence covered the old product.

Re-check when your own use changes. The tool you approved for internal drafts is now customer-facing? That's a new risk profile, and it deserves a new review.

Re-check when the contract renews. Renewal is leverage. Use it to update terms, confirm certifications are current, and ask the questions you've been saving up.

And re-check when the news gets loud — a regulatory action, a widely reported failure, a leadership change at the vendor. You don't need to panic. You need to ask whether anything you relied on has changed.

Annual rhythm, event-driven exceptions. Put both in writing, or neither will happen.

I explain frameworks; I don't give legal counsel.